This turns the has_instance_call_handler bit on Map into an is_callable
bit, that matches the spec definition of IsCallable (i.e. instances have
[[Call]] internal methods).

Also fix the typeof operator to properly say "function" for everything
that is callable.

Also remove the (unused) premature %_GetPrototype optimization from
Crankshaft, which just complicated the Map bit swap.

R=mstarzinger@chromium.org, rossberg@chromium.org, yangguo@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_layout_dbg

Review URL: https://codereview.chromium.org/1316933002

Cr-Commit-Position: refs/heads/master@{#30552}

Rolling v8/tools/clang to 91e7a78800b5849e27e098daa42e6ae8650ad322

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1316403006

Cr-Commit-Position: refs/heads/master@{#30551}

Kills the kRestParameter bailout/disabled optimization, and fixes
lazily parsed arrow functions with rest parameters.

Supercedes https://crrev.com/1235153006/

BUG=chromium:508074, v8:2160, v8:2700
LOG=N
R=rossberg@chromium.org, adamk@chromium.org, wingo@igalia.com

Review URL: https://codereview.chromium.org/1272673003

Cr-Commit-Position: refs/heads/master@{#30550}

Add methods for converting parameter index to a register and vice-versa.

Move Register class into bytecodes.h.

Update Bytecodes::Decode to pretty print parameters.

BUG=v8:4280
LOG=NO

Review URL: https://codereview.chromium.org/1325983002

Cr-Commit-Position: refs/heads/master@{#30549}

This is a follow-up to a previous change and moved object statistics
tracking into its own component. It is no longer intertwinded with the
normal marking logic, but separated out into ObjectStatsVisitor.

R=mlippautz@chromium.org

Review URL: https://codereview.chromium.org/1310953008

Cr-Commit-Position: refs/heads/master@{#30548}

Note that this is only pulling out the bookkeeping side of things, the
marking visitor that actually records the statistics should also move
into the ObjectStats class. That will be done as a follow-up.

R=mlippautz@chromium.org

Review URL: https://codereview.chromium.org/1326793002

Cr-Commit-Position: refs/heads/master@{#30547}

- Use the new ElementsAccessor methods
- improve test coverage

BUG=

Review URL: https://codereview.chromium.org/1317053006

Cr-Commit-Position: refs/heads/master@{#30546}

Port c29a4061

R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1325103003

Cr-Commit-Position: refs/heads/master@{#30545}

Code::WipeOutHeader now nulls out the next code link to avoid
embedding that address in snapshot.

BUG=
LOG=NO

Review URL: https://codereview.chromium.org/1310503006

Cr-Commit-Position: refs/heads/master@{#30544}

Adds support for property load operations via Load/KeyedLoad ICs. Adds the
following bytecodes:
 - LoadIC
 - KeyedLoadIC
Also adds support to the interpreter assembler for loading the type feedback
vector from the function on the stack, and calling ICs.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1309843007

Cr-Commit-Position: refs/heads/master@{#30543}

BUG=

Review URL: https://codereview.chromium.org/1314503003

Cr-Commit-Position: refs/heads/master@{#30542}

Prerequisite for sealing strong class instances.

Depends on https://codereview.chromium.org/1314203002/

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1316333002

Cr-Commit-Position: refs/heads/master@{#30541}

BUG=

Review URL: https://codereview.chromium.org/1313023003

Cr-Commit-Position: refs/heads/master@{#30540}

Remove intersection from the `std::map`s representing current live
ArrayBuffers. While being simpler to understand, it poses significant
performance issue for the active ArrayBuffer users (like node.js).

Store buffers separately, and process them together during mark-sweep
phase.

BUG=
R=mlippautz@chromium.org

Review URL: https://codereview.chromium.org/1326613002

Cr-Commit-Position: refs/heads/master@{#30539}

BUG=chromium:523307
LOG=N

Review URL: https://codereview.chromium.org/1304923003

Cr-Commit-Position: refs/heads/master@{#30538}

Revert of [turbofan] Greedy: using hints (patchset #2 id:60001 of https://codereview.chromium.org/1329493004/ )

Reason for revert:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20debug%20-%20greedy%20allocator/builds/1338

Original issue's description:
> [turbofan] Greedy: using hints
>
> This is a rudimentary introduction of hints. Primarily this helps with
> allocating on the same register variables are defined (from instructions)
> For dealing with phis, we need to introduce groups, in a subsequent
> CL.
>
> From the last CL (memory ops heuristics), this CL improves some
> benchmarks - notably Life (11.94%) in Emscripten x64, and Memops
> (Emscripten), 24% on x86; notable regressions: Memops in
> AreWeFastYet (-14%, x64) and Corrections -25% on x86.
>
> BUG=
>
> Committed: https://crrev.com/038f5eaf3bd6796ed6b7519de83c21d4e1f54850
> Cr-Commit-Position: refs/heads/master@{#30534}

TBR=jarin@chromium.org,bmeurer@chromium.org,mtrofin@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1324763005

Cr-Commit-Position: refs/heads/master@{#30537}

This is causing build breaks for Node.js w/ V8 4.6.

Map::kInObjectPropertiesOffset was been replaced by
kInObjectPropertiesOrConstructorFunctionIndexOffset in
https://codereview.chromium.org/1276533003. This is causing the post-mortem
debug information generation to fail.

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1308113007

Cr-Commit-Position: refs/heads/master@{#30536}

The AlwaysAllocate scope make it impossible to enforce a DCHECK on the maximum
old generation sizes as e.g. large objects can still be allocated using this
scope. Returning false here results in OOM.

R=mstarzinger@chromium.org
BUG=chromium:525448
LOG=N

Review URL: https://codereview.chromium.org/1316183004

Cr-Commit-Position: refs/heads/master@{#30535}

This is a rudimentary introduction of hints. Primarily this helps with
allocating on the same register variables are defined (from instructions)
For dealing with phis, we need to introduce groups, in a subsequent
CL.

From the last CL (memory ops heuristics), this CL improves some
benchmarks - notably Life (11.94%) in Emscripten x64, and Memops
(Emscripten), 24% on x86; notable regressions: Memops in
AreWeFastYet (-14%, x64) and Corrections -25% on x86.

BUG=

Review URL: https://codereview.chromium.org/1329493004

Cr-Commit-Position: refs/heads/master@{#30534}

The spec says that the "this value" has to be an Object.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1325023003

Cr-Commit-Position: refs/heads/master@{#30533}

Repeat the same signatures for future refactoring

BUG=

Review URL: https://codereview.chromium.org/1302413006

Cr-Commit-Position: refs/heads/master@{#30532}

Fixes all bad casts associated with operands of call and select operators
in the test suite.

Cleanup for cfi_vptr=1; see https://www.chromium.org/developers/testing/control-flow-integrity

BUG=chromium:457523
R=bmeurer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1329643002

Cr-Commit-Position: refs/heads/master@{#30531}

Rolling v8/build/gyp to 121d89dfcd4f6ebe1c89524b3f9ca11ddd437e77

Rolling v8/tools/clang to a09a5fee59be457e0d7213d86f8bac72d232860d

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1322933004

Cr-Commit-Position: refs/heads/master@{#30530}

We're moving away from using CompilationInfo as a big bag o' stuff.
Passing in just what we need to several AstVisitors to avoid
increasing the problem.

BUG=None
TEST=trybots
R=titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1318823010

Cr-Commit-Position: refs/heads/master@{#30529}

The arm64 build is missing a few recently-added files.

Compiling with msan requires that v8 be compiled in arm64 mode. Hook this up.

Review URL: https://codereview.chromium.org/1316233005

Cr-Commit-Position: refs/heads/master@{#30528}

Disable the polyfill in simd.js tests as the functions for Phase 1 have been implemented.

BUG=v8:4124
LOG=N

R=bbudge@chromium.org, bmeurer@chromium.org, littledan@chromium.org

Committed: https://crrev.com/749ba3a13558cb018a2ec783e5dfb56d2f8528d8
Cr-Commit-Position: refs/heads/master@{#30452}

Review URL: https://codereview.chromium.org/1305923005

Cr-Commit-Position: refs/heads/master@{#30527}

Move BackingStore specific implementation from builtins.cc tp ElementsAccessor

BUG=

Review URL: https://codereview.chromium.org/1322803002

Cr-Commit-Position: refs/heads/master@{#30526}

Move the --harmony-sloppy-let flag to staging for further testing, and
update test262 for the new passing tests. Also increase the strictness
of the parser, even in sloppy mode, to disallow "new legacy compat" for

  for (let x = 5 in {}) {}

which is now a SyntaxError.

BUG=v8:3305
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1321013005

Cr-Commit-Position: refs/heads/master@{#30525}

* Enforce invariants on the way.
* Unmark flaky CodeRange test.

BUG=v8:4141
BUG=v8:3005
LOG=N

Review URL: https://codereview.chromium.org/1325853003

Cr-Commit-Position: refs/heads/master@{#30524}

Having both flags is tedious, and it is unlikely you'd ever want them
separately.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1304163010

Cr-Commit-Position: refs/heads/master@{#30523}

Implement a lock free version of RolloverProtectedTickClock::Now
to eliminate a deadlock.

BUG=chromium:521420
LOG=Y

Committed: https://crrev.com/d6db8e5902af1f067f0f149844f4e92824ee93f3
Cr-Commit-Position: refs/heads/master@{#30489}

Review URL: https://codereview.chromium.org/1304873011

Cr-Commit-Position: refs/heads/master@{#30522}

Follow-up of https://codereview.chromium.org/1298973007/

Fix syntax

R=adamk@chromium.org, machenbach@chromium.org

Review URL: https://codereview.chromium.org/1324813003

Cr-Commit-Position: refs/heads/master@{#30521}

Walk asm.js module ASTs, attach concrete type information
in preparation for generating a WASM module.

cctest test coverage (mjsunit coming in later CL).
Expressions, function tables, and foreign functions have coverage.
Statement coverage to be expanded in a later CL.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-asm-validator
R=rossberg@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1322773002

Cr-Commit-Position: refs/heads/master@{#30520}

Since the constructor is also the class object itself, allowing it to
retroactively become a strong object would have unintuitive consequences
wrt the strength of the other functions of the class, and whether instances
would be considered instances of a strong class.

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1314203002

Cr-Commit-Position: refs/heads/master@{#30519}

Reason for revert:
Fails a test262 test with --always-opt.

Original issue's description:
> Stage sloppy let
>
> Move the --harmony-sloppy-let flag to staging for further testing, and
> update test262 for the new passing tests. Also increase the strictness
> of the parser, even in sloppy mode, to disallow "new legacy compat" for
>
>   for (let x = 5 in {}) {}
>
> which is now a SyntaxError.
>
> BUG=v8:3305
> LOG=Y
> R=adamk
>
> Committed: https://crrev.com/07bc0117be8dc9e63ec14d5f9645c483d60a1bec
> Cr-Commit-Position: refs/heads/master@{#30515}

TBR=adamk@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3305

Review URL: https://codereview.chromium.org/1324033002

Cr-Commit-Position: refs/heads/master@{#30518}

BUG=chromium:520702
LOG=N

Review URL: https://codereview.chromium.org/1316213005

Cr-Commit-Position: refs/heads/master@{#30517}

Port 29ebcc32

Original commit message:
    This CL introduces HPrologue instruction which does the context allocation work and supports deoptimization.

R=ishell@chromium.org, jyan@ca.ibm.com, dstence@us.ibm.com, joransiu@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1324023002

Cr-Commit-Position: refs/heads/master@{#30516}

Move the --harmony-sloppy-let flag to staging for further testing, and
update test262 for the new passing tests. Also increase the strictness
of the parser, even in sloppy mode, to disallow "new legacy compat" for

  for (let x = 5 in {}) {}

which is now a SyntaxError.

BUG=v8:3305
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1327483002

Cr-Commit-Position: refs/heads/master@{#30515}

R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1302413007

Cr-Commit-Position: refs/heads/master@{#30514}

This turns the absolute list of linter rules within the presubmit.py
wrapper into a list relative to the default of the cpplint.py script.
This has the advantage that new rules are picked up when the script is
updated and that allowed violations are visible from the list.

R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1325833005

Cr-Commit-Position: refs/heads/master@{#30513}